build(deps): bump golang.design/x/hotkey from 0.4.1 to 0.6.1

[dependabot]

Bumps golang.design/x/hotkey from 0.4.1 to 0.6.1.

Release notes

Sourced from golang.design/x/hotkey's releases.

v0.6.1

Security

Resolves all open Dependabot advisories by bumping the example module's transitive dependencies golang.org/x/net and golang.org/x/image to v0.38.0.

These were development-only dependencies pulled in by the examples' GUI libraries. The importable hotkey module — which depends only on golang.design/x/mainthread — was never affected, and its code is unchanged from v0.6.0.

Full changelog: golang-design/hotkey@v0.6.0...v0.6.1

v0.6.0

This release changes how hotkeys work on macOS. Linux and Windows are unaffected.

⚠️ macOS: Accessibility permission is now required for all hotkeys

macOS hotkeys are now delivered through a CGEventTap instead of Carbon RegisterEventHotKey — a single mechanism now serves both regular and media keys, and the tap can consume the event so it does not also reach the focused app. (#46, closes #45)

As a result, every macOS hotkey now requires the application to be trusted for Accessibility (Input Monitoring) — previously only media keys (added in v0.5.0) needed it, and regular hotkeys needed no permission at all.

• Grant permission in System Settings → Privacy & Security → Accessibility.
• Without it, Register() returns an error (it does not crash or silently no-op).
• Sandboxed apps may be unable to use global hotkeys under this model.

🔒 Privacy note

To deliver hotkeys this way, the package now installs a global keyboard event tap. By construction such a tap can observe keyboard events system-wide; this package uses it only to match the specific key combinations you register and forward their press/release — it does not store, log, or transmit anything. The Accessibility permission prompt the OS shows reflects this capability. If you ship an application built on this package, mention the Accessibility requirement to your users.

Notes

• If you only need media keys, or you want the previous permission-free behavior for regular hotkeys on macOS, stay on v0.5.0 (Carbon for regular hotkeys + a tap for media keys).
• Docs (package doc + README) now describe the macOS Accessibility requirement.

Full changelog: golang-design/hotkey@v0.5.0...v0.6.0

v0.5.0

⚠️ Breaking changes

• Minimum Go is now 1.24 (was 1.17). (#37, #42)
• Key is now uint32 on all platforms (was uint8 on macOS, uint16 on Linux/Windows). Explicit narrowing casts such as uint16(key) must be updated; hotkey.KeyA and hotkey.Key(0x15) are unaffected. (#42)
• Register/Unregister error messages were normalized across platforms (text changed). (#41)

New features

• Media keys on all platforms — KeyMediaPlayPause, KeyMediaNext, KeyMediaPrev, KeyMediaStop, KeyVolumeUp, KeyVolumeDown, KeyVolumeMute. Linux uses XF86* keysyms, Windows VK_MEDIA_*, macOS a CGEventTap. See https://github.com/golang-design/hotkey/blob/HEAD/examples/media. (#42, #43, #44)
  • macOS: media keys require Accessibility (Input Monitoring) permission; without it Register() returns an error. KeyMediaStop is not available on macOS. Normal hotkeys are unchanged and still need no permission.
• OpenBSD (X11) support. (#36)

... (truncated)

Commits

• 16255fc examples: bump golang.org/x/net and x/image to v0.38.0 (#47)
• f614750 feat(darwin): unify all macOS hotkeys on CGEventTap, drop Carbon (#46)
• f8f76b8 feat(darwin): media keys via CGEventTap (hybrid) (#44)
• 40661d1 all: add media key constants for Linux (X11) and Windows (#43)
• 404034a all: widen Key to uint32 on every platform (#42)
• 3dfe3ac all: normalize Register/Unregister error messages across platforms (#41)
• bf8ed50 fix(linux): return an error when the hotkey is already grabbed (#40)
• c020a9e fix: dispatch.h import on case-sensitive macOS (#31)
• 25a95c8 all: add OpenBSD (X11) support (#36)
• 2d3b7a6 fix(linux): cancel the X11 event loop on unregister (#38)
• Additional commits viewable in compare view

[github-actions]

Package	Line Rate	Health
devtoolbox/internal/barcode	93%	✔
devtoolbox/internal/codeformatter	80%	➖
devtoolbox/internal/converter	65%	➖
devtoolbox/internal/datagenerator	81%	✔
devtoolbox/internal/datetimeconverter	75%	➖
devtoolbox/internal/jwt	47%	❌
devtoolbox/internal/numberconverter	98%	✔
devtoolbox/internal/settings	0%	❌
devtoolbox/internal/themes	0%	❌
Summary	70% (3726 / 5294)	➖

Minimum allowed line rate is 60%